redline | 5459835af56f5d5fd3bf0a3abb1cedc126a63c57eef8c0bcbd797366177a8f0d

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 05:46

Target

8218e24698a7118d8377e60c30d92341.exe
Size

201KB
MD5

8218e24698a7118d8377e60c30d92341
SHA1

0219cab4c3d1203badfc6666ab632ac5c29946f1
SHA256

5459835af56f5d5fd3bf0a3abb1cedc126a63c57eef8c0bcbd797366177a8f0d
SHA512

21354dd4d9d8df643f8117e7a029361a2368d5ae7f6edace27e8bdb2797aba453b0b003820bfe9391783c847438438ff7b45afe872640dc3befcf1357005d7f6
SSDEEP

3072:KxLeZ1gif5JlqfrtfugOQU7sJn9XQHwKSMHkZtERVsJtyAip0QMvB:eLNJDVSfkZQQKSmetE+tUp0QMv

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2372-56-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2372-58-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2372-60-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2372	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	8218e24698a7118d8377e60c30d92341.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2432 wrote to memory of 2372	2432	8218e24698a7118d8377e60c30d92341.exe	28
PID 2372 wrote to memory of 2836	2372	8218e24698a7118d8377e60c30d92341.exe	29
PID 2372 wrote to memory of 2836	2372	8218e24698a7118d8377e60c30d92341.exe	29
PID 2372 wrote to memory of 2836	2372	8218e24698a7118d8377e60c30d92341.exe	29
PID 2372 wrote to memory of 2836	2372	8218e24698a7118d8377e60c30d92341.exe	29

memory/2372-56-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2372-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2372-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2372-61-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2372-63-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-54-0x00000000010D0000-0x0000000001108000-memory.dmp

Filesize
224KB

Download
memory/2432-55-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2432-62-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download